CVE-2025-59424: LinkAce Vulnerable to Stored XSS on the Audit Page
LinkAce is a self-hosted archive to collect website links. Prior to 2.3.1, a Stored Cross-Site Scripting (XSS) vulnerability has been identified on the /system/audit page. The application fails to properly sanitize the username field before it is rendered in the audit log. An authenticated attacker can set a malicious JavaScript payload as their username. When an action performed by this user is recorded (e.g., generate or revoke an API token), the payload is stored in the database. The script is then executed in the browser of any user, particularly administrators, who views the /system/audit page. This vulnerability is fixed in 2.3.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59424?
CVE-2025-59424 is classified as a medium severity vulnerability due to its potential impact on user security through stored cross-site scripting.
How do I fix CVE-2025-59424?
To fix CVE-2025-59424, upgrade LinkAce to version 2.3.1 or later, where the vulnerability has been addressed.
What types of attacks can exploit CVE-2025-59424?
CVE-2025-59424 can be exploited through stored cross-site scripting attacks, allowing attackers to execute malicious scripts in user browsers.
Who is affected by CVE-2025-59424?
Users of LinkAce versions prior to 2.3.1 are affected by CVE-2025-59424 due to improper sanitization of the username field.
What is the potential impact of CVE-2025-59424?
The potential impact of CVE-2025-59424 includes unauthorized access to sensitive data and compromised user sessions due to cross-site scripting.